December 2016 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELY-842) Coverity: wrong condition in ProviderLoaderService.unregisterProviders (Elytron subsystem)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-842?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-842: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity: wrong condition in ProviderLoaderService.unregisterProviders (Elytron subsystem) > ------------------------------------------------------------------------------------------ > > Key: ELY-842 > URL: https://issues.jboss.org/browse/ELY-842 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Priority: Critical > > Coverity static-analysis scan found an issue in a loop within the {{ProviderLoaderService.unregisterProviders}} method. > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > The condition is wrong in the code > {code:java} > for (int i = providers.length - 1; i < 0; i--) { > Security.removeProvider(providers[i].getName()); > } > {code} > There should be {{i >= 0}} instead of {{i < 0}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-843) Coverity: Logically dead code in PermissionMapperDefinitions (Elytron subsystem)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-843?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-843: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity: Logically dead code in PermissionMapperDefinitions (Elytron subsystem) > -------------------------------------------------------------------------------- > > Key: ELY-843 > URL: https://issues.jboss.org/browse/ELY-843 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Labels: static_analysis > > Coverity static-analysis scan found a logically dead code in the {{PermissionMapperDefinitions.getSimplePermissionMapper}} method. > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > Following code > {code:java} > permissionMappings.add(new Mapping(principals != null ? principals : Collections.emptySet(), > roles != null ? roles : Collections.emptySet(), permissions)); > {code} > should rather be > {code:java} > permissionMappings.add(new Mapping(principals, roles, permissions)); > {code} > because both {{principals}} and {{roles}} local variables are initialized ({{new HashSet...}}) before this piece of code. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-844) Coverity: default platform encoding used in TokenRealmDefinition (Elytron subsystem)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-844?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-844: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity: default platform encoding used in TokenRealmDefinition (Elytron subsystem) > ------------------------------------------------------------------------------------ > > Key: ELY-844 > URL: https://issues.jboss.org/browse/ELY-844 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Priority: Minor > Labels: static_analysis > > Coverity static-analysis scan found a String to byte conversion with default platform encoding in the {{TokenRealmDefinition.performRuntime}} method. > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > Following code > {code:java} > jwtValidatorBuilder.publicKey(publicKey.getBytes()); > {code} > The encoding should be specified as argument. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-846) Coverity: dereference null value in PermissionMapperDefinitions (Elytron subsystem)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-846?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-846: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity: dereference null value in PermissionMapperDefinitions (Elytron subsystem) > ----------------------------------------------------------------------------------- > > Key: ELY-846 > URL: https://issues.jboss.org/browse/ELY-846 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Labels: static_analysis > > Coverity static-analysis scan found a possilbe method call on null object in the {{PermissionMapperDefinitions.createPermission}} method. > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > {code:java} > Module currentModule = Module.getCallerModule(); > if (permission.getModule() != null) { > ModuleIdentifier mi = ModuleIdentifier.fromString(permission.getModule()); > try { > currentModule = currentModule.getModule(mi); > {code} > The {{currentModule}} value returned from {{Module.getCallerModule()}} may be {{null}}. The {{getModule()}} method is called on it without the null-check. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-845) Coverity: dereference null value in ClassLoadingAttributeDefinitions (Elytron subsystem)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-845?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-845: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity: dereference null value in ClassLoadingAttributeDefinitions (Elytron subsystem) > ---------------------------------------------------------------------------------------- > > Key: ELY-845 > URL: https://issues.jboss.org/browse/ELY-845 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Labels: static_analysis > > Coverity static-analysis scan found a possilbe method call on null object in the {{ClassLoadingAttributeDefinitions.resolveClassLoader}} method. > https://scan7.coverity.com/reports.htm#v16159/p12663/fileInstanceId=68921... > Following code > {code:java} > Module current = Module.getCallerModule(); > if (module != null) { > ModuleIdentifier mi = ModuleIdentifier.fromString(module); > current = current.getModule(mi); > {code} > The {{current}} value returned from {{Module.getCallerModule()}} may be {{null}}. The {{getModule()}} method is called on it without the null-check. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2128) Upgrade xnio from 3.4.1 to 3.4.2

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2128?page=com.atlassian.jira.plugi... ] Kabir Khan moved JBEAP-7950 to WFCORE-2128: ------------------------------------------- Project: WildFly Core (was: JBoss Enterprise Application Platform) Key: WFCORE-2128 (was: JBEAP-7950) Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1) > Upgrade xnio from 3.4.1 to 3.4.2 > -------------------------------- > > Key: WFCORE-2128 > URL: https://issues.jboss.org/browse/WFCORE-2128 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: Kabir Khan > Assignee: Kabir Khan > Fix For: 3.0.0.Alpha16 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2128) Upgrade xnio from 3.4.1 to 3.4.2

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2128?page=com.atlassian.jira.plugi... ] Kabir Khan resolved WFCORE-2128. -------------------------------- Fix Version/s: 3.0.0.Alpha16 Resolution: Done > Upgrade xnio from 3.4.1 to 3.4.2 > -------------------------------- > > Key: WFCORE-2128 > URL: https://issues.jboss.org/browse/WFCORE-2128 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: Kabir Khan > Assignee: Kabir Khan > Fix For: 3.0.0.Alpha16 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7800) Export jackson-jaxrs-json-provider dependency in resteasy-jackson2-provider module

by Dmitrii Tikhomirov (JIRA)

[ https://issues.jboss.org/browse/WFLY-7800?page=com.atlassian.jira.plugin.... ] Dmitrii Tikhomirov updated WFLY-7800: ------------------------------------- Git Pull Request: https://github.com/wildfly/wildfly/pull/9498 > Export jackson-jaxrs-json-provider dependency in resteasy-jackson2-provider module > ---------------------------------------------------------------------------------- > > Key: WFLY-7800 > URL: https://issues.jboss.org/browse/WFLY-7800 > Project: WildFly > Issue Type: Bug > Components: REST > Reporter: Katerina Novotna > Assignee: Dmitrii Tikhomirov > > RFE EAP7-608, Introduces Jackson 2 JsonFilter annotation support for Resteasy. > This cannot be used without explicitly defined dependency for jackson-jaxrs-json-provider in the deployment. > *Actual behaviour:* > Currently a deployment with the resource using JsonFilter annotation must have com.fasterxml.jackson.jaxrs.jackson-jaxrs-json-provider dependency specified in the MANIFEST file in order to correctly deploy. > See example - https://github.com/resteasy/Resteasy/blob/master/testsuite/integration-te... > *Expected behaviour*: > There is no need to add explicit dependency into the deployment. > Dependencies in the modules/system/layers/base/org/jboss/resteasy/resteasy-jackson2-provider/main/module.xml shall be updated to export jackson-jaxrs-json-provider. > {code:java} > <dependencies> > <module name="com.fasterxml.jackson.core.jackson-annotations" export="true"/> > <module name="com.fasterxml.jackson.core.jackson-core" export="true"/> > <module name="com.fasterxml.jackson.core.jackson-databind" export="true"/> > <module name="com.fasterxml.jackson.jaxrs.jackson-jaxrs-json-provider" export="true"/> > ... > {code} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-850) Elytron ldap-realm allows access with empty password

by Ondrej Lukas (JIRA)

[ https://issues.jboss.org/browse/ELY-850?page=com.atlassian.jira.plugin.sy... ] Ondrej Lukas updated ELY-850: ----------------------------- Component/s: Realms > Elytron ldap-realm allows access with empty password > ---------------------------------------------------- > > Key: ELY-850 > URL: https://issues.jboss.org/browse/ELY-850 > Project: WildFly Elytron > Issue Type: Bug > Components: Realms > Affects Versions: 1.1.0.Beta17 > Reporter: Ondrej Lukas > Assignee: Darran Lofthouse > Priority: Blocker > > An empty password is treated as an anonymous login by some LDAP servers (e.g. by Microsoft Active Directory). In case when Elytron ldap-realm is configured for that type of LDAP server then access with empty password to secured web resource guarded by that ldap-realm is always granted. > There should be some attribute for configuring whether empty password should be accepted by ldap-realm. > Similar issue occurs in previous versions of application server, see: > * https://bugzilla.redhat.com/show_bug.cgi?id=901251 > * https://bugzilla.redhat.com/show_bug.cgi?id=885569 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-850) Elytron ldap-realm allows access with empty password

by Ondrej Lukas (JIRA)

[ https://issues.jboss.org/browse/ELY-850?page=com.atlassian.jira.plugin.sy... ] Ondrej Lukas updated ELY-850: ----------------------------- Affects Version/s: 1.1.0.Beta17 > Elytron ldap-realm allows access with empty password > ---------------------------------------------------- > > Key: ELY-850 > URL: https://issues.jboss.org/browse/ELY-850 > Project: WildFly Elytron > Issue Type: Bug > Affects Versions: 1.1.0.Beta17 > Reporter: Ondrej Lukas > Assignee: Darran Lofthouse > Priority: Blocker > > An empty password is treated as an anonymous login by some LDAP servers (e.g. by Microsoft Active Directory). In case when Elytron ldap-realm is configured for that type of LDAP server then access with empty password to secured web resource guarded by that ldap-realm is always granted. > There should be some attribute for configuring whether empty password should be accepted by ldap-realm. > Similar issue occurs in previous versions of application server, see: > * https://bugzilla.redhat.com/show_bug.cgi?id=901251 > * https://bugzilla.redhat.com/show_bug.cgi?id=885569 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira December 2016